Darko Gjorgjijoski 107a951126 fix(security): recompute document totals server-side (GHSA-8c69) (#665)
Invoice/estimate/recurring-invoice creation and update accepted total,
sub_total, tax and due_amount straight from the request with no server-side
recalculation, so a client could persist financial totals that don't match the
line items (and, on invoice update, corrupt the due-amount/paid-amount logic
which keyed off the client total).

- Adds App\Support\DocumentTotals which recomputes item totals (round(price *
  quantity) minus per-item discount) and document totals (sub_total, tax with
  per-item vs document and tax_included handling, total, due_amount), mirroring
  the front-end calculation. Only price/quantity/discounts/tax-line amounts are
  trusted.
- getInvoicePayload/getEstimatePayload/getRecurringInvoicePayload override the
  client totals with the recomputed values; createItems recomputes each stored
  item total; Invoice::updateInvoice keys its due-amount/paid-amount logic off
  the recomputed total instead of the request total.

Adds DocumentTotals unit tests + a feature test proving a tampered invoice
total is ignored. Existing create/update tests no longer assert the (now
server-authoritative) derived totals.
2026-06-12 09:30:44 +02:00
2026-06-11 08:36:05 +02:00
2026-06-05 00:48:47 +02:00
2026-04-07 18:35:30 +02:00
2026-04-05 12:07:47 +02:00
2026-06-11 08:36:05 +02:00
2026-06-11 08:36:05 +02:00
2026-06-11 08:36:05 +02:00
2026-06-11 08:36:05 +02:00
2021-06-18 15:23:56 +05:30
2026-03-21 19:14:51 +01:00
2025-08-31 03:04:31 +02:00
2024-07-28 17:44:22 -07:00
2026-06-11 08:36:05 +02:00
2024-07-28 17:24:57 +02:00
2026-06-11 08:36:05 +02:00
2024-01-28 19:47:46 +01:00
2026-06-11 08:36:05 +02:00
2024-03-27 11:00:36 +01:00
2021-12-02 21:01:04 +05:30
2024-07-12 03:08:07 +02:00
2024-06-05 11:33:52 +02:00
2026-03-24 07:07:41 +01:00
2026-06-05 00:48:47 +02:00
2024-01-29 04:46:01 -06:00
2021-11-30 18:58:19 +05:30
2026-04-07 21:25:20 +02:00

Introduction

InvoiceShelf is an open-source web & mobile app that helps you track expenses, payments & create professional invoices & estimates.

The Web Application is made using Laravel & VueJS while the Mobile Apps are built using React Native.

To get started with InvoiceShelf using Docker Compose, check out the Installation docs.

Table of Contents

  1. Documentation
  2. Download
  3. Mobile Apps
  4. Discord - NEW 🔥
  5. Roadmap
  6. Credits
  7. Help us translate
  8. License

Documentation

System Requirements

  • Starting from v2.2.0 (Laravel 13 upgrade), InvoiceShelf requires PHP 8.4+.
  • Before updating from the app settings, verify your server PHP version and required extensions.
  • The in-app updater checks requirements and blocks the update if they are not met.

Download

Mobile Apps

  • Andorid - Coming Soon
  • IOS - Coming Soon
  • Source

Discord

Join the InvoiceShelf discord server to discuss: Invite Link

Roadmap

~~Here's a rough roadmap of things to come (not in any specific order):

  • Automatic Update
  • Email Configuration
  • Installation Wizard
  • Address Customisation & Default notes
  • Edit Email before Sending Invoice
  • Available as a docker image
  • Performance Improvements
  • Customer View page
  • Add and Use Custom Fields on Invoices & Estimates.
  • Multiple Companies
  • Recurring Invoices
  • Customer Portal
  • Accept Payments (Stripe Integration)
  • Improved template system (invoices and estimate)
  • Modules and templates marketplace

Credits

InvoiceShelf is made possible thanks to the contributions and support from many people and projects:

  • Crater (project inspiration and code base)
  • All contributors who have provided code, translations, reported issues, or supported the project in any way.

Translate

Help us translate on https://crowdin.com/project/invoiceshelf

License

InvoiceShelf is released under the GNU AFFERO GENERAL PUBLIC LICENSE Version 3. See LICENSE for details.

Description
No description provided
Readme AGPL-3.0 76 MiB
Languages
PHP 59.9%
Vue 36.1%
Blade 3.2%
Shell 0.6%
Dockerfile 0.1%